Tech debt: Operational Experience review

[heitorlessa]

Why is this needed?

There are a few areas left from v1 to v2 we couldn't optimize, namely for now are:

• Disable auto-merge workflow #2204
• Investigate use of OSSF Scorecard #2205
• Split release build job into quality checks and build #2206
• Remove allow list from untrusted workflows #2207
• Create changelog on a schedule #2208
• Replace changelog workflow trigger to manual dispatch #2209
• Create PRs from workflows (e.g., changelog, docs layer, docs) #2210
• Review Layer build mechanism #2211
• Investigate uploading additional release artifacts (e.g., provenance) #2212
• Review default GH Actions permissions scope vs workflow global vs workflow job scope #2213
• Add documentation at the top of workflows as complexity is growing
• Convert reusable workflows to composite actions
• Use format built-in function to use constants for hashing folders
• Create visual representation of release process as per @leandrodamascena ask

Which area does this relate to?

Other

Suggestion

No response

Acknowledgment

• This request meets Lambda Powertools Tenets
• Should this be considered in other Lambda Powertools languages? i.e. Java, TypeScript, and .NET

[heitorlessa]

Using variables with hashFiles() doesn't work as expected, hashes don't match due to string interpolation.

We've got two options here: 1/ Keep as-is, 2/ Create a hash script ourselves -- WDYT @leandrodamascena ?

[github-actions]

This is now released under 2.18.0 version!